Release v1.2.140

Backend image: dculus/forms-backend:v1.2.140 (promoted from the build verified on dev).

What's Changed

• build(deps): bump the patch-updates group across 1 directory with 68 updates by @dependabot[bot] in #431
• Remove unbacked SLA and "thousands of teams" claims from pricing page by @bannarisoftwares in #439
• fix(security): resolve all High findings from the security review by @bannarisoftwares in #442
• fix(security): complete remaining security review items (plugins, automations, encryption at rest) by @bannarisoftwares in #445
• fix(security): only reject nested credential writes when encryption is enabled by @bannarisoftwares in #447
• docs(security): update findings tracker with remediation status by @bannarisoftwares in #448
• fix(security): resolve Medium findings from the security review by @bannarisoftwares in #449
• test(e2e): only refuse the public default password on hosted targets by @bannarisoftwares in #452
• fix(auth): relax sign-in rate limit on dev for post-deploy E2E by @bannarisoftwares in #453
• fix(backend): restore default DB pool size of 2 by @bannarisoftwares in #454
• docs(security): update review tracker by @bannarisoftwares in #455
• refactor(billing): Chargebee-only plan limits + add-on support by @bannarisoftwares in #456
• feat(billing): add-on management in admin app + catalog-driven plans across apps by @bannarisoftwares in #457
• feat(billing): SES-aware plan sizing + AI credits add-on; setup script adds feature levels by @bannarisoftwares in #458

Full Changelog: v1.2.139...v1.2.140